cve.bz

CWE-156: Improper Neutralization of Whitespace

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component, e.g., space or tab.

What the weakness is: CWE-156 at MITRE. All weaknesses

Ask an AI about CWE-156

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-156: Improper Neutralization of Whitespace and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/156.html and https://cve.bz/cve/cwe/156?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2025-55127EPSS 0.2%

    HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its …

  2. 6.5CVE-2025-55001EPSS 0.3%

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon…

  3. 6.5CVE-2025-55000EPSS 0.3%

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times…

  4. 8.1CVE-2025-6013EPSS 0.6%

    Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Editi…

  5. 6.5CVE-2025-6014EPSS 0.5%

    Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.